Method, system and program product for verifying access to a data object

• US 20060020599A1
• Filed: 07/22/2004
• Published: 01/26/2006
• Est. Priority Date: 07/22/2004
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Murray, Douglas G., Martin, James A. Jr., Rauch, Diane C.
• Granted Patent: US 7,739,303 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

An improved solution for verifying access to a data object. In particular, the invention automatically determines when access to the data object requires verification and provides an owner of the data object a set of current users for verification. The set of current users can include all or a subset of the users/user groups that have access to the data object. Additionally, an indication of one or more attributes of each user can be provided to the owner to assist in verification. Access information can be updated based on a response from the owner.

Claims

1. A computer-implemented method of verifying access to a data object, the method comprising:

automatically determining whether access to the data object requires verification;

obtaining an owner for the data object;

obtaining a set of current users having access to the data object;

providing the set of current users to the owner; and

receiving a set of verified users.

2. The method of claim 1, wherein the determining step includes:

obtaining a frequency period for verifying access to the data object;

obtaining a previous time that access was verified for the data object; and

determining whether the frequency period has passed since the previous time.

3. The method of claim 2, further comprising updating the previous time after receiving the set of verified users.

4. The method of claim 1, further comprising updating the set of current users based on the set of verified users.

5. The method of claim 4, further comprising preventing access to the data object until the set of current users has been updated.

6. The method of claim 1, wherein the obtaining a set of current users step comprises:

determining a set of current user groups that have access to the data object;

determining a set of additional users; and

generating the set of current users by selecting from the set of current user groups and the set of additional users.

7. The method of claim 1, further comprising, for each user in the set of current users:

determining if the user is a current employee; and

indicating whether the user comprises a current employee.

8. The method of claim 1, wherein the providing step comprises:

generating an electronic message that comprises a description of the data object and the set of current users; and

sending the electronic message to the owner.

9. A computer-implemented method of requesting verification of access to a data object, the method comprising:

obtaining a frequency period for verifying access to the data object;

obtaining a previous time that the access was verified for the data object;

determining that the frequency period has passed since the previous time;

obtaining an owner for the data object; and

sending a request to the owner to verify access to the data object.

10. The method of claim 9, further comprising:

obtaining a set of current users having access to the data object; and

providing the set of current users to the owner.

11. The method of claim 10, wherein the obtaining a set of current users step comprises:

determining a set of current user groups that have access to the data object;

determining a set of additional users; and

generating the set of current users by selecting from the set of current user groups and the set of additional users.

12. The method of claim 10, further comprising, for each user in the set of current users:

obtaining at least one attribute for the user; and

indicating the at least one attribute to the owner.

13. A system for verifying access to a data object, the system comprising:

a monitor system for automatically determining when access to the data object requires verification;

an owner system for obtaining an owner for the data object;

a selection system for obtaining a set of current users having access to the data object; and

a verification system for providing the set of current users to the owner.

14. The system of claim 13, wherein the verification system further receives a set of verified users.

15. The system of claim 14, further comprising an access system for updating the set of current users based on the set of verified users.

16. The system of claim 13, further comprising an attribute system for obtaining at least one attribute for each user in the set of current users.

17. A program product stored on a recordable medium for verifying access to a data object, which when executed comprises:

program code for automatically determining when access to the data object requires verification;

program code for obtaining an owner for the data object;

program code for obtaining a set of current users having access to the data object; and

program code for providing the set of current users to the owner.

18. The program product of claim 17, further comprising program code for receiving a set of verified users.

19. The program product of claim 18, further comprising program code for updating the set of current users based on the set of verified users.

20. The program product of claim 17, further comprising program code for indicating each user in the set of current users that is not a current employee.

21. A system for deploying an application for requesting verification of access to a data object, the system comprising:

a computer infrastructure being operable to;

automatically determine when access to the data object requires verification;

obtain an owner for the data object;

obtain a set of current users having access to the data object; and

provide the set of current users to the owner.

22. The system of claim 21, wherein the computer infrastructure is further operable to indicate at least one attribute for each user in the set of current users.

23. Computer software embodied in a propagated signal for verifying access to a data object, the computer software comprising instructions to cause a computer system to perform the following functions:

automatically determine when access to the data object requires verification;

obtain an owner for the data object;

obtain a set of current users having access to the data object;

provide the set of current users to the owner;

receive a set of verified users; and

update the set of current users based on the set of verified users.